From 177dc4eb96c926756604de4f9d0271572902a2b3 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 28 Jan 2021 14:36:52 -0700
Subject: [PATCH 01/45] ntdsutil export NTDS.dit

Broke out ntdsutil.exe from creation_of_shadow_copy to allow for better filtering and specific monitoring/alerting.
---
 .../endpoint/creation_of_shadow_copy.yml      |  9 ++--
 detections/endpoint/ntdsutil_export_ntds.yml  | 49 +++++++++++++++++++
 tests/endpoint/ntdsutil_export_ntds.test.yml  | 12 +++++
 3 files changed, 65 insertions(+), 5 deletions(-)
 create mode 100644 detections/endpoint/ntdsutil_export_ntds.yml
 create mode 100644 tests/endpoint/ntdsutil_export_ntds.test.yml

diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml
index 9f27e6a9f9..dac83e296a 100644
--- a/detections/endpoint/creation_of_shadow_copy.yml
+++ b/detections/endpoint/creation_of_shadow_copy.yml
@@ -2,7 +2,7 @@ name: Creation of Shadow Copy
 id: eb120f5f-b879-4a63-97c1-93352b5df844
 version: 1
 date: '2019-12-10'
-description: Monitor for signs that Ntdsutil, Vssadmin, or Wmic has been used to create
+description: Monitor for signs that Vssadmin or Wmic has been used to create
   a shadow copy.
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
@@ -13,14 +13,13 @@ references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
 author: Patrick Bareiss, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=ntdsutil.exe
-  Processes.process=*ntds* Processes.process=*create*) OR (Processes.process_name=vssadmin.exe
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe
   Processes.process=*create* Processes.process=*shadow*) OR (Processes.process_name=wmic.exe
   Processes.process=*shadowcopy* Processes.process=*create*) by Processes.dest Processes.user
   Processes.process_name Processes.process  Processes.parent_process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`'
-known_false_positives: Legtimate administrator usage of Ntdsutil, Vssadmin, or Wmic
+known_false_positives: Legitimate administrator usage of Vssadmin or Wmic
   will create false positives.
 tags:
   analytics_story:
@@ -38,4 +37,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - hhttps://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml
new file mode 100644
index 0000000000..fe06b599cc
--- /dev/null
+++ b/detections/endpoint/ntdsutil_export_ntds.yml
@@ -0,0 +1,49 @@
+name: Ntdsutil Export NTDS
+id: da63bc76-61ae-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-28'
+description: Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit,
+  typically used for offline password cracking.
+  It may be used in normal circumstances with no command line arguments or shorthand variations
+  of more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. 
+  Typical command used to dump ntds.dit \
+  
+  ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \
+  
+  This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database.
+  A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node. The command-line arguments are mapped to the "process"
+  field in the Endpoint data model.
+type: ESCU
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
+author: Michael Haag, Patrick Bareiss, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=ntdsutil.exe
+  Processes.process=*ntds* Processes.process=*create*) by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `ntdsutil_dump_ntds_filter`'
+known_false_positives: Highly possible Server Administrators will troubleshoot
+  with ntdsutil.exe, generating false positives.
+tags:
+  analytics_story:
+  - Credential Dumping
+  mitre_attack_id:
+  - T1003.003
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  - CIS 16
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/ntdsutil_export_ntds.test.yml b/tests/endpoint/ntdsutil_export_ntds.test.yml
new file mode 100644
index 0000000000..0454c467c9
--- /dev/null
+++ b/tests/endpoint/ntdsutil_export_ntds.test.yml
@@ -0,0 +1,12 @@
+name: NTdsutil export ntds dit Unit Test
+tests:
+- name: NTdsutil to export ntds dit from Directory Services
+  file: endpoint/ntdsutil_export_ntds.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From 4576b9f72bc81e04fd5b9cb6aeef2b792a408f01 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 28 Jan 2021 14:43:33 -0700
Subject: [PATCH 02/45] Update ntdsutil_export_ntds.yml

---
 detections/endpoint/ntdsutil_export_ntds.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml
index fe06b599cc..9da67e95e4 100644
--- a/detections/endpoint/ntdsutil_export_ntds.yml
+++ b/detections/endpoint/ntdsutil_export_ntds.yml
@@ -1,4 +1,4 @@
-name: Ntdsutil Export NTDS
+name: Ntdsutil export ntds
 id: da63bc76-61ae-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-28'
@@ -28,7 +28,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process=*ntds* Processes.process=*create*) by Processes.dest Processes.user
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `ntdsutil_dump_ntds_filter`'
+  `security_content_ctime(lastTime)` | `ntdsutil_export_ntds_filter`'
 known_false_positives: Highly possible Server Administrators will troubleshoot
   with ntdsutil.exe, generating false positives.
 tags:

From c445ef14b9a9c128fe6401cbdc9afc8e5bb07b80 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-210-193>
Date: Thu, 28 Jan 2021 22:07:24 +0000
Subject: [PATCH 03/45] Added detection testing service results inNTdsutil to
 export ntds dit from Directory Services

---
 detections/endpoint/ntdsutil_export_ntds.yml | 24 +++++++++++---------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml
index 9da67e95e4..3c704fc6b8 100644
--- a/detections/endpoint/ntdsutil_export_ntds.yml
+++ b/detections/endpoint/ntdsutil_export_ntds.yml
@@ -2,16 +2,17 @@ name: Ntdsutil export ntds
 id: da63bc76-61ae-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-28'
-description: Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit,
-  typically used for offline password cracking.
-  It may be used in normal circumstances with no command line arguments or shorthand variations
-  of more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. 
-  Typical command used to dump ntds.dit \
-  
+description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
+  database - NTDS.dit, typically used for offline password cracking. It may be used
+  in normal circumstances with no command line arguments or shorthand variations of
+  more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical
+  command used to dump ntds.dit \
+
   ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \
-  
-  This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database.
-  A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination.
+
+  This technique uses "Install from Media" (IFM), which will extract a copy of the
+  Active Directory database. A successful export of the Active Directory database
+  will yield a file modification named ntds.dit to the destination.'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
@@ -29,8 +30,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `ntdsutil_export_ntds_filter`'
-known_false_positives: Highly possible Server Administrators will troubleshoot
-  with ntdsutil.exe, generating false positives.
+known_false_positives: Highly possible Server Administrators will troubleshoot with
+  ntdsutil.exe, generating false positives.
 tags:
   analytics_story:
   - Credential Dumping
@@ -47,3 +48,4 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From 3d5d188dd7f0b0d4e627fce46d927fdeec46073c Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 29 Jan 2021 10:58:53 -0700
Subject: [PATCH 04/45] Regsvr32 Story and Analytics

First batch of Regsvr32
---
 ...ct_regsvr32_application_control_bypass.yml | 47 +++++++++++++++++++
 ...ious_regsvr32_register_suspicious_path.yml | 45 ++++++++++++++++++
 .../endpoint/suspicious_regsvr32_rename.yml   | 43 +++++++++++++++++
 stories/suspicious_mshta_activity.yml         |  2 +-
 stories/suspicious_regsvr32_activity.yml      | 40 ++++++++++++++++
 ...gsvr32_application_control_bypass.test.yml | 12 +++++
 ...suspicious_regsvr32_register_path.test.yml | 12 +++++
 .../suspicious_regsvr32_rename.test.yml       | 12 +++++
 8 files changed, 212 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/detect_regsvr32_application_control_bypass.yml
 create mode 100644 detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
 create mode 100644 detections/endpoint/suspicious_regsvr32_rename.yml
 create mode 100644 stories/suspicious_regsvr32_activity.yml
 create mode 100644 tests/endpoint/detect_regsvr32_application_control_bypass.test.yml
 create mode 100644 tests/endpoint/suspicious_regsvr32_register_path.test.yml
 create mode 100644 tests/endpoint/suspicious_regsvr32_rename.test.yml

diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
new file mode 100644
index 0000000000..4844275e01
--- /dev/null
+++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
@@ -0,0 +1,47 @@
+name: Detect Regsvr32 Application Control Bypass
+id: 070e9b80-6252-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-28'
+description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. 
+  Regsvr32.exe is a command-line program used to register and unregister object linking
+  and embedding controls, including dynamic link libraries (DLLs), on Windows systems.
+  Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is
+  often referred to as a "Squiblydoo" attack.
+  
+  Upon investigating, look for network connections to remote destinations (internal or external). 
+  Be cautious to modify the query to look for `scrobj.dll`, the `.dll` is not required to load scrobj.
+  `scrobj.dll` will be loaded by `regsvr32.exe` upon execution. '
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node. The command-line arguments are mapped to the "process"
+  field in the Endpoint data model. Tune the query by modifying/removing the !=regsv32.exe.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/010/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
+- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
+- https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=regsvr32.exe OR Processes.process_name!=regsvr32.exe)
+  Processes.process=*scrobj* by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter`'
+known_false_positives: Limited false positives related to third party software registering .DLL's.
+tags:
+  analytics_story:
+  - Suspicious Regsvr32 Activity
+  mitre_attack_id:
+  - T1218.010
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  - CIS 16
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
\ No newline at end of file
diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
new file mode 100644
index 0000000000..565b7be728
--- /dev/null
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -0,0 +1,45 @@
+name: Suspicious Regsvr32 Register Suspicious Path
+id: 62732736-6250-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-28'
+description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code
+  by using non-standard file extensions to load malciious DLLs. 
+  Upon investigating, look for network connections to remote destinations (internal or external).
+  Review additional parrallel processes and child processes for additional activity.'
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node. The command-line arguments are mapped to the "process"
+  field in the Endpoint data model. Tune the query by filtering additional extensions found to be used by  legitimate processes.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/010/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
+- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
+- https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5
+- https://any.run/report/f29a7d2ecd3585e1e4208e44bcc7156ab5388725f1d29d03e7699da0d4598e7c/0826458b-5367-45cf-b841-c95a33a01718
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe
+ (Processes.process=*appdata* OR Processes.process=*programdata* OR Processes.process=*windows\temp*)
+ (Processes.process!=*.dll Processes.process!=*.ax Processes.process!=*.ocx)
+  by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
+known_false_positives: Limited false positives with the query restricted to specified paths. Add more world writeable paths as tuning continues.
+tags:
+  analytics_story:
+  - Suspicious Regsvr32 Activity
+  mitre_attack_id:
+  - T1218.010
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  - CIS 16
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
\ No newline at end of file
diff --git a/detections/endpoint/suspicious_regsvr32_rename.yml b/detections/endpoint/suspicious_regsvr32_rename.yml
new file mode 100644
index 0000000000..1c77af5142
--- /dev/null
+++ b/detections/endpoint/suspicious_regsvr32_rename.yml
@@ -0,0 +1,43 @@
+name: Suspicious Regsvr32 Rename
+id: 0b8e6e18-6259-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-29'
+description: The following analytic identifies renamed instances of regsvr32.exe executing.
+  regsvr32.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64. During investigation, validate it is the legitimate regsvr32.exe
+  executing and what content it is loading. 
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed regsvr32.exe may be used. Review
+  paths of the renamed instance.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/010/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
+- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=REGSVR32.EXE OR process_name!=regsvr32.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `suspicious_regsvr32_rename_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of regsvr32, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious Regsvr32 Activity
+  mitre_attack_id:
+  - T1218.010
+  - T1036.003
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/windows-sysmon.log
diff --git a/stories/suspicious_mshta_activity.yml b/stories/suspicious_mshta_activity.yml
index d08c86333a..77ed2d3710 100644
--- a/stories/suspicious_mshta_activity.yml
+++ b/stories/suspicious_mshta_activity.yml
@@ -4,7 +4,7 @@ version: 2
 date: '2021-01-20'
 description: Monitor and detect techniques used by attackers who leverage the mshta.exe
   process to execute malicious code.
-narrative: 'One common adversary tactic is to bypass application white-listing solutions
+narrative: 'One common adversary tactic is to bypass application control solutions
   via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta
   suffix. In these cases, attackers use the trusted Windows utility to proxy execution
   of malicious files, whether an .hta application, javascript, or VBScript.\
diff --git a/stories/suspicious_regsvr32_activity.yml b/stories/suspicious_regsvr32_activity.yml
new file mode 100644
index 0000000000..96a6848639
--- /dev/null
+++ b/stories/suspicious_regsvr32_activity.yml
@@ -0,0 +1,40 @@
+name: Suspicious Regsvr32 Activity
+id: b8bee41e-624f-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-29'
+description: Monitor and detect techniques used by attackers who leverage the regsvr32.exe
+  process to execute malicious code.
+narrative: 'One common adversary tactic is to bypass application control solutions
+  via the regsvr32.exe process. This particular bypass was popularized with "SquiblyDoo"
+  using the `scrobj.dll` dll to load `.sct` scriptlets. This technique is still widely used
+  by adversaries to bypass detection and prevention controls. 
+  The file extension of the DLL is irrelevant (it may load a .txt for example). 
+
+  The searches in this story help you detect and investigate suspicious activity that
+  may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. 
+  
+  Triage \
+  Validate execution \
+  1. Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further
+  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.
+  2. Determine if script code was executed with regsvr32. \
+  Situational Awareness \
+  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by regsvr32.exe. \
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
+  2. Module loads. Are the known regsvr32.exe modules being loaded by a non-standard application? Is
+  regsvr32 loading any suspicious .DLLs?
+  3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
+  Retrieval of script code \
+  The objective of this step is to confirm the executed script code is benign or malicious.'
+author: Michael Haag, Splunk
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/010/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
+- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
+tags:
+  analytics_story: Suspicious Regsvr32 Activity
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics
diff --git a/tests/endpoint/detect_regsvr32_application_control_bypass.test.yml b/tests/endpoint/detect_regsvr32_application_control_bypass.test.yml
new file mode 100644
index 0000000000..c975e940bc
--- /dev/null
+++ b/tests/endpoint/detect_regsvr32_application_control_bypass.test.yml
@@ -0,0 +1,12 @@
+name: Detect Regsvr32 Appication Control Bypass Unit Test
+tests:
+- name: Detect regsvr32 Application Control Bypass
+  file: endpoint/detect_regsvr32_application_control_bypass.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_regsvr32_register_path.test.yml b/tests/endpoint/suspicious_regsvr32_register_path.test.yml
new file mode 100644
index 0000000000..7f283e20e9
--- /dev/null
+++ b/tests/endpoint/suspicious_regsvr32_register_path.test.yml
@@ -0,0 +1,12 @@
+name: Detect Regsvr32 Register Path Unit Test
+tests:
+- name: Detect regsvr32 Registering DLLs from non-standard paths
+  file: endpoint/detect_regsvr32_register_suspicious_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_regsvr32_rename.test.yml b/tests/endpoint/suspicious_regsvr32_rename.test.yml
new file mode 100644
index 0000000000..c105746de6
--- /dev/null
+++ b/tests/endpoint/suspicious_regsvr32_rename.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious regsvr32 rename
+tests:
+- name: Detect renamed regsvr32 execution
+  file: endpoint/suspicious_regsvr32_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 921bd3aec657c99031cda97ad2041f788c897491 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 29 Jan 2021 11:03:01 -0700
Subject: [PATCH 05/45] Update suspicious_regsvr32_activity.yml

---
 stories/suspicious_regsvr32_activity.yml | 17 +----------------
 1 file changed, 1 insertion(+), 16 deletions(-)

diff --git a/stories/suspicious_regsvr32_activity.yml b/stories/suspicious_regsvr32_activity.yml
index 96a6848639..e1a5dcc862 100644
--- a/stories/suspicious_regsvr32_activity.yml
+++ b/stories/suspicious_regsvr32_activity.yml
@@ -11,22 +11,7 @@ narrative: 'One common adversary tactic is to bypass application control solutio
   The file extension of the DLL is irrelevant (it may load a .txt for example). 
 
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. 
-  
-  Triage \
-  Validate execution \
-  1. Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further
-  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.
-  2. Determine if script code was executed with regsvr32. \
-  Situational Awareness \
-  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
-  Script code by regsvr32.exe. \
-  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
-  2. Module loads. Are the known regsvr32.exe modules being loaded by a non-standard application? Is
-  regsvr32 loading any suspicious .DLLs?
-  3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
-  Retrieval of script code \
-  The objective of this step is to confirm the executed script code is benign or malicious.'
+  may indicate that an adversary is leveraging regsvr32.exe to execute malicious code.'
 author: Michael Haag, Splunk
 type: ESCU
 references:

From 26e9acd0b868ba8a80e60fcfed3cc76b96c3f2c0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 29 Jan 2021 11:07:33 -0700
Subject: [PATCH 06/45] Update suspicious_regsvr32_activity.yml

---
 stories/suspicious_regsvr32_activity.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/stories/suspicious_regsvr32_activity.yml b/stories/suspicious_regsvr32_activity.yml
index e1a5dcc862..af8dcdb77a 100644
--- a/stories/suspicious_regsvr32_activity.yml
+++ b/stories/suspicious_regsvr32_activity.yml
@@ -6,10 +6,9 @@ description: Monitor and detect techniques used by attackers who leverage the re
   process to execute malicious code.
 narrative: 'One common adversary tactic is to bypass application control solutions
   via the regsvr32.exe process. This particular bypass was popularized with "SquiblyDoo"
-  using the `scrobj.dll` dll to load `.sct` scriptlets. This technique is still widely used
+  using the "scrobj.dll" dll to load .sct scriptlets. This technique is still widely used
   by adversaries to bypass detection and prevention controls. 
   The file extension of the DLL is irrelevant (it may load a .txt for example). 
-
   The searches in this story help you detect and investigate suspicious activity that
   may indicate that an adversary is leveraging regsvr32.exe to execute malicious code.'
 author: Michael Haag, Splunk

From 4fc95b6dd24cf57a62d448cf403ec23cc2756c68 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 29 Jan 2021 11:15:35 -0700
Subject: [PATCH 07/45] regsvr32

---
 .../endpoint/detect_regsvr32_application_control_bypass.yml | 6 +++---
 stories/suspicious_regsvr32_activity.yml                    | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
index 4844275e01..1b88c7334a 100644
--- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml
+++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
@@ -6,11 +6,11 @@ description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious
   Regsvr32.exe is a command-line program used to register and unregister object linking
   and embedding controls, including dynamic link libraries (DLLs), on Windows systems.
   Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is
-  often referred to as a "Squiblydoo" attack.
+  often referred to as a "Squiblydoo" attack. \
   
   Upon investigating, look for network connections to remote destinations (internal or external). 
-  Be cautious to modify the query to look for `scrobj.dll`, the `.dll` is not required to load scrobj.
-  `scrobj.dll` will be loaded by `regsvr32.exe` upon execution. '
+  Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj.
+  "scrobj.dll" will be loaded by "regsvr32.exe" upon execution. '
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
diff --git a/stories/suspicious_regsvr32_activity.yml b/stories/suspicious_regsvr32_activity.yml
index af8dcdb77a..cc922fe190 100644
--- a/stories/suspicious_regsvr32_activity.yml
+++ b/stories/suspicious_regsvr32_activity.yml
@@ -21,4 +21,4 @@ tags:
   analytics_story: Suspicious Regsvr32 Activity
   usecase: Advanced Threat Detection
   category:
-  - Adversary Tactics
+  - Adversary Tactics
\ No newline at end of file

From b6bb7f86a80fd1d3772f1f9ecd53326fa149b323 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-108-83>
Date: Fri, 29 Jan 2021 18:38:54 +0000
Subject: [PATCH 08/45] Added detection testing service results inDetect
 regsvr32 Application Control Bypass

---
 ...ct_regsvr32_application_control_bypass.yml | 27 ++++++++++---------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
index 1b88c7334a..1a7ab59f8b 100644
--- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml
+++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
@@ -2,15 +2,16 @@ name: Detect Regsvr32 Application Control Bypass
 id: 070e9b80-6252-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-28'
-description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. 
+description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.
   Regsvr32.exe is a command-line program used to register and unregister object linking
   and embedding controls, including dynamic link libraries (DLLs), on Windows systems.
   Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is
   often referred to as a "Squiblydoo" attack. \
-  
-  Upon investigating, look for network connections to remote destinations (internal or external). 
-  Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj.
-  "scrobj.dll" will be loaded by "regsvr32.exe" upon execution. '
+
+  Upon investigating, look for network connections to remote destinations (internal
+  or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll"
+  is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon
+  execution. '
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
@@ -23,12 +24,13 @@ references:
 - https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5
 author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=regsvr32.exe OR Processes.process_name!=regsvr32.exe)
-  Processes.process=*scrobj* by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter`'
-known_false_positives: Limited false positives related to third party software registering .DLL's.
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=regsvr32.exe
+  OR Processes.process_name!=regsvr32.exe) Processes.process=*scrobj* by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter`'
+known_false_positives: Limited false positives related to third party software registering
+  .DLL's.
 tags:
   analytics_story:
   - Suspicious Regsvr32 Activity
@@ -44,4 +46,5 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
\ No newline at end of file
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From 3551039f097799a9d9e41ce2826cb8962fc30351 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 29 Jan 2021 11:48:19 -0700
Subject: [PATCH 09/45] register suspicious path rename

---
 ....yml => suspicious_regsvr32_register_suspicious_path.test.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename tests/endpoint/{suspicious_regsvr32_register_path.test.yml => suspicious_regsvr32_register_suspicious_path.test.yml} (100%)

diff --git a/tests/endpoint/suspicious_regsvr32_register_path.test.yml b/tests/endpoint/suspicious_regsvr32_register_suspicious_path.test.yml
similarity index 100%
rename from tests/endpoint/suspicious_regsvr32_register_path.test.yml
rename to tests/endpoint/suspicious_regsvr32_register_suspicious_path.test.yml

From 781572a7d63e4707c5b991271cb715f7216a63c7 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 29 Jan 2021 13:34:40 -0700
Subject: [PATCH 10/45] Update
 suspicious_regsvr32_register_suspicious_path.test.yml

---
 .../suspicious_regsvr32_register_suspicious_path.test.yml     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/suspicious_regsvr32_register_suspicious_path.test.yml b/tests/endpoint/suspicious_regsvr32_register_suspicious_path.test.yml
index 7f283e20e9..0735471a9d 100644
--- a/tests/endpoint/suspicious_regsvr32_register_suspicious_path.test.yml
+++ b/tests/endpoint/suspicious_regsvr32_register_suspicious_path.test.yml
@@ -1,7 +1,7 @@
-name: Detect Regsvr32 Register Path Unit Test
+name: Detect Regsvr32 Register Suspicious Path Unit Test
 tests:
 - name: Detect regsvr32 Registering DLLs from non-standard paths
-  file: endpoint/detect_regsvr32_register_suspicious_path.yml
+  file: endpoint/suspicious_regsvr32_register_suspicious_path.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 3def2593d4718a9be9b1661730245b6599247208 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-213-182>
Date: Fri, 29 Jan 2021 20:55:42 +0000
Subject: [PATCH 11/45] Added detection testing service results inDetect
 regsvr32 Registering DLLs from non-standard paths

---
 ...ious_regsvr32_register_suspicious_path.yml | 28 ++++++++++---------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
index 565b7be728..677419eeef 100644
--- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -2,14 +2,15 @@ name: Suspicious Regsvr32 Register Suspicious Path
 id: 62732736-6250-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-28'
-description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code
-  by using non-standard file extensions to load malciious DLLs. 
-  Upon investigating, look for network connections to remote destinations (internal or external).
-  Review additional parrallel processes and child processes for additional activity.'
+description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code
+  by using non-standard file extensions to load malciious DLLs. Upon investigating,
+  look for network connections to remote destinations (internal or external). Review
+  additional parrallel processes and child processes for additional activity.
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model. Tune the query by filtering additional extensions found to be used by  legitimate processes.
+  field in the Endpoint data model. Tune the query by filtering additional extensions
+  found to be used by  legitimate processes.
 type: ESCU
 references:
 - https://attack.mitre.org/techniques/T1218/010/
@@ -20,13 +21,13 @@ references:
 author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe
- (Processes.process=*appdata* OR Processes.process=*programdata* OR Processes.process=*windows\temp*)
- (Processes.process!=*.dll Processes.process!=*.ax Processes.process!=*.ocx)
-  by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
-known_false_positives: Limited false positives with the query restricted to specified paths. Add more world writeable paths as tuning continues.
+  (Processes.process=*appdata* OR Processes.process=*programdata* OR Processes.process=*windows\temp*)
+  (Processes.process!=*.dll Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
+known_false_positives: Limited false positives with the query restricted to specified
+  paths. Add more world writeable paths as tuning continues.
 tags:
   analytics_story:
   - Suspicious Regsvr32 Activity
@@ -42,4 +43,5 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
\ No newline at end of file
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From a0c2a1bcd6fd5a17e71f3e9fbe676f62c73a528e Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 29 Jan 2021 14:23:02 -0700
Subject: [PATCH 12/45] Update suspicious_mshta_activity.yml

---
 stories/suspicious_mshta_activity.yml | 28 ++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/stories/suspicious_mshta_activity.yml b/stories/suspicious_mshta_activity.yml
index 77ed2d3710..39968b78a8 100644
--- a/stories/suspicious_mshta_activity.yml
+++ b/stories/suspicious_mshta_activity.yml
@@ -10,21 +10,27 @@ narrative: 'One common adversary tactic is to bypass application control solutio
   of malicious files, whether an .hta application, javascript, or VBScript.\
 
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an attacker is leveraging mshta.exe to execute malicious code. \
+  may indicate that an attacker is leveraging mshta.exe to execute malicious code.\
   
-  Triage \
+  Triage\
   Validate execution \
   1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further
-  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.
-  2. Determine if script code was executed with MSHTA. \
-  Situational Awareness \
+  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.\
+  
+  1. Determine if script code was executed with MSHTA.\
+  
+  Situational Awareness\
   The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
-  Script code by MSHTA.exe. \
-  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
-  2. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is
-  MSHTA loading any suspicious .DLLs?
-  3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
-  Retrieval of script code \
+  Script code by MSHTA.exe.\
+
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\
+
+  1. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is
+  MSHTA loading any suspicious .DLLs?\
+
+  1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\
+  
+  Retrieval of script code\
   The objective of this step is to confirm the executed script code is benign or malicious.'
 author: Bhavin Patel, Michael Haag, Splunk
 type: ESCU

From ef829b6f9a3625969d9ed72ea62d0a7a916deac3 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 29 Jan 2021 14:57:05 -0700
Subject: [PATCH 13/45] Regsvr32 rename fix

Fixes
---
 .../endpoint/suspicious_regsvr32_rename.yml   |  2 +-
 ...oper_utilities_proxy_execution_msbuild.yml | 38 ++++++++++++-------
 2 files changed, 25 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/suspicious_regsvr32_rename.yml b/detections/endpoint/suspicious_regsvr32_rename.yml
index 1c77af5142..53432e4aa5 100644
--- a/detections/endpoint/suspicious_regsvr32_rename.yml
+++ b/detections/endpoint/suspicious_regsvr32_rename.yml
@@ -17,7 +17,7 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
 - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
 author: Michael Haag, Splunk
-search: '`sysmon` EventID=1 (OriginalFileName=REGSVR32.EXE OR process_name!=regsvr32.exe)
+search: '`sysmon` EventID=1 (OriginalFileName=REGSVR32.EXE NOT process_name=regsvr32.exe)
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
   parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
   rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
index 355aa38376..9afa461d44 100644
--- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -7,30 +7,40 @@ description: Monitor and detect techniques used by attackers who leverage the ms
 narrative: 'Adversaries may use MSBuild to proxy execution of code through a trusted 
   Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform
   used by Visual Studio and is native to Windows. It handles XML formatted project
-  files that define requirements for loading and building various platforms and configurations. \
+  files that define requirements for loading and building various platforms and configurations.\
 
   The inline task capability of MSBuild that was introduced in .NET version 4 allows
   for C# code to be inserted into an XML project file. MSBuild will compile and
   execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is
   used this way it can execute arbitrary code and bypass application control defenses
-  that are configured to allow MSBuild.exe execution. \
+  that are configured to allow MSBuild.exe execution.\
 
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an adversary is leveraging msbuild.exe to execute malicious code. \
+  may indicate that an adversary is leveraging msbuild.exe to execute malicious code.\
   
-  Triage \
-  Validate execution \
+  Triage\
+
+  Validate execution\
+
   1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further
-  PE metadata.
-  2. Determine if script code was executed with MSBuild.
-  Situational Awareness \
+  PE metadata.\
+  
+  1. Determine if script code was executed with MSBuild.\
+  
+  Situational Awareness\
+
   The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
-  Script code by MSBuild.exe. \
-  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
-  2. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is
-  MSbuild loading any suspicious .DLLs?
-  3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
-  Retrieval of script code \
+  Script code by MSBuild.exe.\
+  
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\
+  
+  1. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is
+  MSbuild loading any suspicious .DLLs?\
+  
+  1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\
+  
+  Retrieval of script code\
+  
   The objective of this step is to confirm the executed script code is benign or malicious.'
 author: Michael Haag, Splunk
 type: ESCU

From ee7e2d7d96b2cb56624fbdda21673511889771c4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 1 Feb 2021 10:43:55 -0700
Subject: [PATCH 14/45] Update suspicious_regsvr32_rename.yml

---
 detections/endpoint/suspicious_regsvr32_rename.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_regsvr32_rename.yml b/detections/endpoint/suspicious_regsvr32_rename.yml
index 53432e4aa5..5063f10400 100644
--- a/detections/endpoint/suspicious_regsvr32_rename.yml
+++ b/detections/endpoint/suspicious_regsvr32_rename.yml
@@ -17,7 +17,7 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
 - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
 author: Michael Haag, Splunk
-search: '`sysmon` EventID=1 (OriginalFileName=REGSVR32.EXE NOT process_name=regsvr32.exe)
+search: '`sysmon` EventID=1 (OriginalFileName=REGSVR32.EXE OR process_name=regsvr32.exe)
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
   parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
   rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|

From 0a92fadf76479e08e9f6ed0a212f1e748e09f808 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 1 Feb 2021 12:37:36 -0700
Subject: [PATCH 15/45] dump lsass via procdump

---
 .../endpoint/dump_lsass_via_procdump.yml      | 44 +++++++++++++++++++
 .../endpoint/dump_lsass_via_procdump.test.yml | 12 +++++
 2 files changed, 56 insertions(+)
 create mode 100644 detections/endpoint/dump_lsass_via_procdump.yml
 create mode 100644 tests/endpoint/dump_lsass_via_procdump.test.yml

diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
new file mode 100644
index 0000000000..1f5a4ee079
--- /dev/null
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -0,0 +1,44 @@
+name: Dump LSASS via procdump
+id: 3742ebfe-64c2-11eb-ae93-0242ac130002
+version: 1
+date: '2021-02-01'
+description: Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. 
+  -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect
+  and should be reviewed. This query does not monitor for the internal name (procdump) of the PE or look for procdump64.exe.
+  Modify the query as needed.\
+
+  During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, 
+  there will always be a -accepteula on the command line.
+  Review other endpoint data sources for cross process (injection) into lsass.exe.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1003/001/
+- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe
+  (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*ls* by Processes.user Processes.process_name
+  Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
+known_false_positives: None identified.
+tags:
+  analytics_story:
+  - Credential Dumping
+  mitre_attack_id:
+  - T1003.001
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/dump_lsass_via_procdump.test.yml b/tests/endpoint/dump_lsass_via_procdump.test.yml
new file mode 100644
index 0000000000..40d26e48fb
--- /dev/null
+++ b/tests/endpoint/dump_lsass_via_procdump.test.yml
@@ -0,0 +1,12 @@
+name: Dump LSASS via procdump Unit Test
+tests:
+- name: Dump LSASS via procdump
+  file: endpoint/dump_lsass_via_procdump.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From 33ff45c0ed2198163b674f9f3fd0a7d54f785c65 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 1 Feb 2021 12:39:30 -0700
Subject: [PATCH 16/45] Update dump_lsass_via_procdump.yml

---
 detections/endpoint/dump_lsass_via_procdump.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index 1f5a4ee079..fdad5cd019 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -21,7 +21,7 @@ references:
 author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe
-  (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*ls* by Processes.user Processes.process_name
+  (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name
   Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
 known_false_positives: None identified.

From 7325dc53406701ded4a0c9e3160b26c676d4b213 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-169-152>
Date: Mon, 1 Feb 2021 19:59:30 +0000
Subject: [PATCH 17/45] Added detection testing service results inDump LSASS
 via procdump

---
 .../endpoint/dump_lsass_via_procdump.yml      | 20 ++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index fdad5cd019..296bc33cea 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -2,14 +2,15 @@ name: Dump LSASS via procdump
 id: 3742ebfe-64c2-11eb-ae93-0242ac130002
 version: 1
 date: '2021-02-01'
-description: Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. 
-  -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect
-  and should be reviewed. This query does not monitor for the internal name (procdump) of the PE or look for procdump64.exe.
+description: 'Detect procdump.exe dumping the lsass process. This query looks for
+  both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
+  file with all process memory. Both are highly suspect and should be reviewed. This
+  query does not monitor for the internal name (procdump) of the PE or look for procdump64.exe.
   Modify the query as needed.\
 
-  During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, 
-  there will always be a -accepteula on the command line.
-  Review other endpoint data sources for cross process (injection) into lsass.exe.
+  During triage, confirm this is procdump.exe executing. If it is the first time a
+  Sysinternals utility has been ran, there will always be a -accepteula on the command
+  line. Review other endpoint data sources for cross process (injection) into lsass.exe.'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -21,9 +22,9 @@ references:
 author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe
-  (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name
-  Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
+  (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*lsass* by
+  Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
 known_false_positives: None identified.
 tags:
   analytics_story:
@@ -42,3 +43,4 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From 3d7047ece0a2e51c966d5c6b3491bc70cb0da106 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Mon, 1 Feb 2021 13:04:12 -0700
Subject: [PATCH 18/45] Update dump_lsass_via_procdump.yml

---
 detections/endpoint/dump_lsass_via_procdump.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index 296bc33cea..f0693948f9 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -5,7 +5,7 @@ date: '2021-02-01'
 description: 'Detect procdump.exe dumping the lsass process. This query looks for
   both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
   file with all process memory. Both are highly suspect and should be reviewed. This
-  query does not monitor for the internal name (procdump) of the PE or look for procdump64.exe.
+  query does not monitor for the internal name (OriginalFileName=procdump) of the PE or look for procdump64.exe.
   Modify the query as needed.\
 
   During triage, confirm this is procdump.exe executing. If it is the first time a

From d138f4ea8c879c2cfa7b341a57b3a87d4e330191 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 3 Feb 2021 09:58:51 -0700
Subject: [PATCH 19/45] procdump rename

renamed procdump query using sysmon
---
 .../endpoint/dump_lsass_via_procdump.yml      |  2 +-
 .../dump_lsass_via_procdump_rename.yml        | 45 +++++++++++++++++++
 .../dump_lsass_via_procdump_rename.test.yml   | 12 +++++
 3 files changed, 58 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/dump_lsass_via_procdump_rename.yml
 create mode 100644 tests/endpoint/dump_lsass_via_procdump_rename.test.yml

diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index f0693948f9..cbb385c1ca 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -9,7 +9,7 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo
   Modify the query as needed.\
 
   During triage, confirm this is procdump.exe executing. If it is the first time a
-  Sysinternals utility has been ran, there will always be a -accepteula on the command
+  Sysinternals utility has been ran, it is possible there will be a -accepteula on the command
   line. Review other endpoint data sources for cross process (injection) into lsass.exe.'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/endpoint/dump_lsass_via_procdump_rename.yml
new file mode 100644
index 0000000000..d80dce4745
--- /dev/null
+++ b/detections/endpoint/dump_lsass_via_procdump_rename.yml
@@ -0,0 +1,45 @@
+name: Dump LSASS via procdump Rename 
+id: 21276daa-663d-11eb-ae93-0242ac130002
+version: 1
+date: '2021-02-01'
+description: 'Detect a renamed instance of procdump.exe dumping the lsass process.
+  This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
+  file with all process memory. Both are highly suspect and should be reviewed. 
+  Modify the query as needed.\
+
+  During triage, confirm this is procdump.exe executing. If it is the first time a
+  Sysinternals utility has been ran, it is possible there will be a -accepteula on the command
+  line. Review other endpoint data sources for cross process (injection) into lsass.exe.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1003/001/
+- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+author: Michael Haag, Splunk
+search: '`sysmon` OriginalFileName=procdump  process_name!=procdump*.exe  EventID=1 (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* 
+  | rename Computer as dest 
+  |  stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, process_name, OriginalFileName, CommandLine
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `dump_lsass_via_procdump_rename_filter`'
+known_false_positives: None identified.
+tags:
+  analytics_story:
+  - Credential Dumping
+  mitre_attack_id:
+  - T1003.001
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/dump_lsass_via_procdump_rename.test.yml b/tests/endpoint/dump_lsass_via_procdump_rename.test.yml
new file mode 100644
index 0000000000..fd04f46735
--- /dev/null
+++ b/tests/endpoint/dump_lsass_via_procdump_rename.test.yml
@@ -0,0 +1,12 @@
+name: Dump lsass via procdump rename Unit Test
+tests:
+- name: Dump lsass via procdump rename
+  file: endpoint/dump_lsass_via_procdump_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From be729ae9bbeed144800ded31461ed161511a35d9 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-43-9>
Date: Wed, 3 Feb 2021 17:29:33 +0000
Subject: [PATCH 20/45] Added detection testing service results inDump lsass
 via procdump rename

---
 .../dump_lsass_via_procdump_rename.yml        | 25 ++++++++++---------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/endpoint/dump_lsass_via_procdump_rename.yml
index d80dce4745..c42b56ca30 100644
--- a/detections/endpoint/dump_lsass_via_procdump_rename.yml
+++ b/detections/endpoint/dump_lsass_via_procdump_rename.yml
@@ -1,15 +1,16 @@
-name: Dump LSASS via procdump Rename 
+name: Dump LSASS via procdump Rename
 id: 21276daa-663d-11eb-ae93-0242ac130002
 version: 1
 date: '2021-02-01'
 description: 'Detect a renamed instance of procdump.exe dumping the lsass process.
-  This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
-  file with all process memory. Both are highly suspect and should be reviewed. 
-  Modify the query as needed.\
+  This query looks for both -mm and -ma usage. -mm will produce a mini dump file and
+  -ma will write a dump file with all process memory. Both are highly suspect and
+  should be reviewed. Modify the query as needed.\
 
   During triage, confirm this is procdump.exe executing. If it is the first time a
-  Sysinternals utility has been ran, it is possible there will be a -accepteula on the command
-  line. Review other endpoint data sources for cross process (injection) into lsass.exe.'
+  Sysinternals utility has been ran, it is possible there will be a -accepteula on
+  the command line. Review other endpoint data sources for cross process (injection)
+  into lsass.exe.'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -19,12 +20,11 @@ references:
 - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
 author: Michael Haag, Splunk
-search: '`sysmon` OriginalFileName=procdump  process_name!=procdump*.exe  EventID=1 (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* 
-  | rename Computer as dest 
-  |  stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, process_name, OriginalFileName, CommandLine
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `dump_lsass_via_procdump_rename_filter`'
+search: '`sysmon` OriginalFileName=procdump  process_name!=procdump*.exe  EventID=1
+  (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | rename Computer as
+  dest |  stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,
+  process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter`'
 known_false_positives: None identified.
 tags:
   analytics_story:
@@ -43,3 +43,4 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From dd6286bd0458645d67ab34c32cf8d83c4e2d5756 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 3 Feb 2021 14:57:59 -0700
Subject: [PATCH 21/45] Creation of lsass dump with taskmgr

---
 .../creation_of_lsass_dump_with_taskmgr.yml   | 42 +++++++++++++++++++
 ...eation_of_lsass_dump_with_taskmgr.test.yml | 12 ++++++
 2 files changed, 54 insertions(+)
 create mode 100644 detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
 create mode 100644 tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml

diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
new file mode 100644
index 0000000000..c149a63748
--- /dev/null
+++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
@@ -0,0 +1,42 @@
+name: Creation of lsass Dump with Taskmgr
+id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
+version: 1
+date: '2020-02-03'
+description: Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe.
+  Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. 
+  The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. 
+how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which
+  includes EventCode 11 for detecting file create of lsass.dmp. 
+  This search uses an input macro named `sysmon`.
+  We strongly recommend that you specify your environment-specific configurations
+  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
+  with configurations for your Splunk environment. The search also uses a post-filter
+  macro designed to filter out known false positives.
+type: ESCU
+references:
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, object_category, process_name, TargetFilename
+  | rename Computer as dest 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `creation_of_lsass_dump_with_taskmgr_filter`'
+known_false_positives: Administrators can create memory dumps for debugging purposes,
+  but memory dumps of the LSASS process would be unusual.
+tags:
+  analytics_story:
+  - Credential Dumping
+  mitre_attack_id:
+  - T1003.001
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 6
+  - CIS 8
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Windows
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
diff --git a/tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml b/tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml
new file mode 100644
index 0000000000..f01f2a6d7e
--- /dev/null
+++ b/tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml
@@ -0,0 +1,12 @@
+name: Creation of lsass dump with taskmgr Unit Test
+tests:
+- name: Creation of lsass dump with taskmgr
+  file: endpoint/creation_of_lsass_dump_with_taskmgr.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From 1890a844063ace9799b20e9dece7da3b0905629b Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-217-20>
Date: Wed, 3 Feb 2021 22:20:35 +0000
Subject: [PATCH 22/45] Added detection testing service results inCreation of
 lsass dump with taskmgr

---
 .../creation_of_lsass_dump_with_taskmgr.yml   | 30 +++++++++----------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
index c149a63748..76f78da476 100644
--- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
+++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
@@ -2,26 +2,25 @@ name: Creation of lsass Dump with Taskmgr
 id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
 version: 1
 date: '2020-02-03'
-description: Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe.
-  Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. 
-  The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. 
+description: Detect the hands on keyboard behavior of Windows Task Manager creating
+  a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification
+  will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp,
+  cannot be renamed, however if the dump occurs more than once, it will be named lsass
+  (2).dmp.
 how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which
-  includes EventCode 11 for detecting file create of lsass.dmp. 
-  This search uses an input macro named `sysmon`.
-  We strongly recommend that you specify your environment-specific configurations
-  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
-  with configurations for your Splunk environment. The search also uses a post-filter
-  macro designed to filter out known false positives.
+  includes EventCode 11 for detecting file create of lsass.dmp. This search uses an
+  input macro named `sysmon`. We strongly recommend that you specify your environment-specific
+  configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace
+  the macro definition with configurations for your Splunk environment. The search
+  also uses a post-filter macro designed to filter out known false positives.
 type: ESCU
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
 author: Michael Haag, Splunk
-search: '`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, object_category, process_name, TargetFilename
-  | rename Computer as dest 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `creation_of_lsass_dump_with_taskmgr_filter`'
+search: '`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp |
+  stats count min(_time) as firstTime max(_time) as lastTime by Computer, object_category,
+  process_name, TargetFilename | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `creation_of_lsass_dump_with_taskmgr_filter`'
 known_false_positives: Administrators can create memory dumps for debugging purposes,
   but memory dumps of the LSASS process would be unusual.
 tags:
@@ -40,3 +39,4 @@ tags:
   asset_type: Windows
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From fc8ee105c4a83219dcbbbadaf8feb17adbaed6d0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Wed, 3 Feb 2021 15:37:08 -0700
Subject: [PATCH 23/45] Update creation_of_lsass_dump_with_taskmgr.yml

---
 detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
index 76f78da476..c8a7c97941 100644
--- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
+++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
@@ -15,6 +15,8 @@ how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, w
   also uses a post-filter macro designed to filter out known false positives.
 type: ESCU
 references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager
+- https://attack.mitre.org/techniques/T1003/001/
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
 author: Michael Haag, Splunk
 search: '`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp |

From b2aed2b8168b37e9cb5571cb71799ce8d26d75e7 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Thu, 4 Feb 2021 14:38:54 -0700
Subject: [PATCH 24/45] rundll32 advpack and rename

---
 ...2_application_control_bypass___advpack.yml | 47 +++++++++++++++++++
 .../endpoint/suspicious_rundll32_rename.yml   | 44 +++++++++++++++++
 ...lication_control_bypass___advpack.test.yml | 12 +++++
 .../suspicious_rundll32_rename.test.yml       | 12 +++++
 4 files changed, 115 insertions(+)
 create mode 100644 detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
 create mode 100644 detections/endpoint/suspicious_rundll32_rename.yml
 create mode 100644 tests/endpoint/detect_rundll32_application_control_bypass___advpack.test.yml
 create mode 100644 tests/endpoint/suspicious_rundll32_rename.test.yml

diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
new file mode 100644
index 0000000000..1ea36643ab
--- /dev/null
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
@@ -0,0 +1,47 @@
+name: Detect Rundll32 Application Control Bypass - advpack
+id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8
+version: 1
+date: '2021-02-04'
+description: The following analytic identifies rundll32.exe loading advpack.dll
+  and ieadvpack.dll by calling the LaunchINFSection function. This particular technique will load
+  script code from a file. Upon a successful execution, the following module loads
+  may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify
+  script content origination. Generally, a child process will spawn from rundll32.exe,
+  but that may be bypassed based on script code contents. 
+  Rundll32.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://lolbas-project.github.io/lolbas/Libraries/Advpack/
+- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=RUNDLL32.EXE process_name=rundll32.exe) CommandLine=*advpack*
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `detect_rundll32_application_control_bypass___advpack_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of rundll32, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml
new file mode 100644
index 0000000000..b06c700a5d
--- /dev/null
+++ b/detections/endpoint/suspicious_rundll32_rename.yml
@@ -0,0 +1,44 @@
+name: Suspicious Rundll32 Rename
+id: 7360137f-abad-473e-8189-acbdaa34d114
+version: 1
+date: '2021-02-04'
+description: The following analytic identifies renamed instances of rundll32.exe executing.
+  rundll32.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64. During investigation, validate it is the legitimate rundll32.exe
+  executing and what script content it is loading. This query relies on the OriginalFileName
+  from Sysmon, or internal name from the PE meta data. Expand the query as needed by looking
+  for specific command line arguments outlined in other analytics.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 OriginalFileName=RUNDLL32.EXE NOT process_name=rundll32.exe
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `suspicious_rundll32_rename_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of rundll32, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  - T1036.003
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
diff --git a/tests/endpoint/detect_rundll32_application_control_bypass___advpack.test.yml b/tests/endpoint/detect_rundll32_application_control_bypass___advpack.test.yml
new file mode 100644
index 0000000000..b724031987
--- /dev/null
+++ b/tests/endpoint/detect_rundll32_application_control_bypass___advpack.test.yml
@@ -0,0 +1,12 @@
+name: Detect Rundll32 Application Control Bypass - advpack
+tests:
+- name: Detect Rundll32 Application Control Bypass - advpack and ieadvpack
+  file: endpoint/detect_rundll32_application_control_bypass___advpack.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_rundll32_rename.test.yml b/tests/endpoint/suspicious_rundll32_rename.test.yml
new file mode 100644
index 0000000000..67a20e4bc5
--- /dev/null
+++ b/tests/endpoint/suspicious_rundll32_rename.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious rundll32 rename unit test
+tests:
+- name: Detect Renamed rundll32.exe Rename
+  file: endpoint/suspicious_rundll32_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From a2aec12a9f9b33094ab263d8797ef007094f1086 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-112-29>
Date: Thu, 4 Feb 2021 22:03:10 +0000
Subject: [PATCH 25/45] Added detection testing service results inDetect
 Rundll32 Application Control Bypass - advpack and ieadvpack

---
 ...2_application_control_bypass___advpack.yml | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
index 1ea36643ab..06219f54f7 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
@@ -2,18 +2,17 @@ name: Detect Rundll32 Application Control Bypass - advpack
 id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8
 version: 1
 date: '2021-02-04'
-description: The following analytic identifies rundll32.exe loading advpack.dll
-  and ieadvpack.dll by calling the LaunchINFSection function. This particular technique will load
-  script code from a file. Upon a successful execution, the following module loads
-  may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify
+description: The following analytic identifies rundll32.exe loading advpack.dll and
+  ieadvpack.dll by calling the LaunchINFSection function. This particular technique
+  will load script code from a file. Upon a successful execution, the following module
+  loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify
   script content origination. Generally, a child process will spawn from rundll32.exe,
-  but that may be bypassed based on script code contents. 
-  Rundll32.exe is natively found in C:\Windows\system32 and
-  C:\Windows\syswow64.
+  but that may be bypassed based on script code contents. Rundll32.exe is natively
+  found in C:\Windows\system32 and C:\Windows\syswow64.
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 type: ESCU
 references:
 - https://attack.mitre.org/techniques/T1218/011/
@@ -22,10 +21,10 @@ references:
 - https://lolbas-project.github.io/lolbas/Libraries/Advpack/
 - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
 author: Michael Haag, Splunk
-search: '`sysmon` EventID=1 (OriginalFileName=RUNDLL32.EXE process_name=rundll32.exe) CommandLine=*advpack*
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
-  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
-  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+search: '`sysmon` EventID=1 (OriginalFileName=RUNDLL32.EXE process_name=rundll32.exe)
+  CommandLine=*advpack* | stats count min(_time) as firstTime max(_time) as lastTime
+  by Computer, User, parent_process_name, process_name, OriginalFileName, process_path,
+  CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
   `detect_rundll32_application_control_bypass___advpack_filter`'
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
@@ -44,4 +43,5 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From bfec79252f413bfff412acbac4e8f597927a72fd Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-112-29>
Date: Thu, 4 Feb 2021 22:03:42 +0000
Subject: [PATCH 26/45] Added detection testing service results inDetect
 Renamed rundll32.exe Rename

---
 detections/endpoint/suspicious_rundll32_rename.yml | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml
index b06c700a5d..7e7dddf7c9 100644
--- a/detections/endpoint/suspicious_rundll32_rename.yml
+++ b/detections/endpoint/suspicious_rundll32_rename.yml
@@ -3,11 +3,11 @@ id: 7360137f-abad-473e-8189-acbdaa34d114
 version: 1
 date: '2021-02-04'
 description: The following analytic identifies renamed instances of rundll32.exe executing.
-  rundll32.exe is natively found in C:\Windows\system32 and
-  C:\Windows\syswow64. During investigation, validate it is the legitimate rundll32.exe
-  executing and what script content it is loading. This query relies on the OriginalFileName
-  from Sysmon, or internal name from the PE meta data. Expand the query as needed by looking
-  for specific command line arguments outlined in other analytics.
+  rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During
+  investigation, validate it is the legitimate rundll32.exe executing and what script
+  content it is loading. This query relies on the OriginalFileName from Sysmon, or
+  internal name from the PE meta data. Expand the query as needed by looking for specific
+  command line arguments outlined in other analytics.
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -41,4 +41,5 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From 3d37e93d995962a65750e842c3467751366dc2f1 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Fri, 5 Feb 2021 07:27:02 -0700
Subject: [PATCH 27/45] rundll32 syssetup, setupapi

Adding rundll32 syssetup and setupapi
---
 ...2_application_control_bypass___advpack.yml | 26 +++++-----
 ..._application_control_bypass___setupapi.yml | 49 +++++++++++++++++++
 ..._application_control_bypass___syssetup.yml | 48 ++++++++++++++++++
 ...ication_control_bypass___setupapi.test.yml | 12 +++++
 ...ication_control_bypass___syssetup.test.yml | 12 +++++
 5 files changed, 134 insertions(+), 13 deletions(-)
 create mode 100644 detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
 create mode 100644 detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
 create mode 100644 tests/endpoint/detect_rundll32_application_control_bypass___setupapi.test.yml
 create mode 100644 tests/endpoint/detect_rundll32_application_control_bypass___syssetup.test.yml

diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
index 06219f54f7..179bbb3187 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
@@ -3,16 +3,16 @@ id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8
 version: 1
 date: '2021-02-04'
 description: The following analytic identifies rundll32.exe loading advpack.dll and
-  ieadvpack.dll by calling the LaunchINFSection function. This particular technique
+  ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique
   will load script code from a file. Upon a successful execution, the following module
   loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify
   script content origination. Generally, a child process will spawn from rundll32.exe,
   but that may be bypassed based on script code contents. Rundll32.exe is natively
-  found in C:\Windows\system32 and C:\Windows\syswow64.
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+  found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any
+  network connections and obtain the script content executed. It's possible other files are on disk.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
 type: ESCU
 references:
 - https://attack.mitre.org/techniques/T1218/011/
@@ -21,13 +21,13 @@ references:
 - https://lolbas-project.github.io/lolbas/Libraries/Advpack/
 - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
 author: Michael Haag, Splunk
-search: '`sysmon` EventID=1 (OriginalFileName=RUNDLL32.EXE process_name=rundll32.exe)
-  CommandLine=*advpack* | stats count min(_time) as firstTime max(_time) as lastTime
-  by Computer, User, parent_process_name, process_name, OriginalFileName, process_path,
-  CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
-  `detect_rundll32_application_control_bypass___advpack_filter`'
-known_false_positives: Although unlikely, some legitimate applications may use a moved
-  copy of rundll32, triggering a false positive.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*advpack* by Processes.user Processes.process_name
+  Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `detect_rundll32_application_control_bypass___advpack_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use advpack.dll or ieadvpack.dll, triggering a false positive. 
 tags:
   analytics_story:
   - Suspicious Rundll32 Activity
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
new file mode 100644
index 0000000000..640ada57ad
--- /dev/null
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
@@ -0,0 +1,49 @@
+name: Detect Rundll32 Application Control Bypass - setupapi
+id: 61e7b44a-6088-4f26-b788-9a96ba13b37a
+version: 1
+date: '2021-02-04'
+description: The following analytic identifies rundll32.exe loading setupapi.dll
+  and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load
+  script code from a file. Upon a successful execution, the following module loads
+  may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify
+  script content origination. Generally, a child process will spawn from rundll32.exe,
+  but that may be bypassed based on script code contents. 
+  Rundll32.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64. During investigation, review any
+  network connections and obtain the script content executed. It's possible other files are on disk.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://lolbas-project.github.io/lolbas/Libraries/Setupapi/
+- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*setupapi* by Processes.user Processes.process_name
+  Processes.process Processes.dest 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `detect_rundll32_application_control_bypass___setupapi_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use setupapi triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
new file mode 100644
index 0000000000..90da56494e
--- /dev/null
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
@@ -0,0 +1,48 @@
+name: Detect Rundll32 Application Control Bypass - syssetup
+id: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183
+version: 1
+date: '2021-02-04'
+description: The following analytic identifies rundll32.exe loading syssetup.dll
+  by calling the LaunchINFSection function on the command line. This particular technique will load
+  script code from a file. Upon a successful execution, the following module loads
+  may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify
+  script content origination. Generally, a child process will spawn from rundll32.exe,
+  but that may be bypassed based on script code contents. 
+  Rundll32.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64. During investigation, review any
+  network connections and obtain the script content executed. It's possible other files are on disk.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://lolbas-project.github.io/lolbas/Libraries/Syssetup/
+- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*syssetup* by Processes.user Processes.process_name
+  Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `detect_rundll32_application_control_bypass___syssetup_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use syssetup.dll,
+  triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
diff --git a/tests/endpoint/detect_rundll32_application_control_bypass___setupapi.test.yml b/tests/endpoint/detect_rundll32_application_control_bypass___setupapi.test.yml
new file mode 100644
index 0000000000..1b720043a5
--- /dev/null
+++ b/tests/endpoint/detect_rundll32_application_control_bypass___setupapi.test.yml
@@ -0,0 +1,12 @@
+name: Detect Rundll32 Application Control Bypass - setupapi
+tests:
+- name: Detect Rundll32 Application Control Bypass - setupapi
+  file: endpoint/detect_rundll32_application_control_bypass___setupapi.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/detect_rundll32_application_control_bypass___syssetup.test.yml b/tests/endpoint/detect_rundll32_application_control_bypass___syssetup.test.yml
new file mode 100644
index 0000000000..9440f42dbe
--- /dev/null
+++ b/tests/endpoint/detect_rundll32_application_control_bypass___syssetup.test.yml
@@ -0,0 +1,12 @@
+name: Detect Rundll32 Application Control Bypass - syssetup
+tests:
+- name: Detect Rundll32 Application Control Bypass - syssetup
+  file: endpoint/detect_rundll32_application_control_bypass___syssetup.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From e02e30e423121b43f3c45f100d0ba14a4ebdb313 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-73-92>
Date: Fri, 5 Feb 2021 14:50:23 +0000
Subject: [PATCH 28/45] Added detection testing service results inDetect
 Rundll32 Application Control Bypass - syssetup

---
 ..._application_control_bypass___syssetup.yml | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
index 90da56494e..de2b4b6ce6 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
@@ -2,15 +2,15 @@ name: Detect Rundll32 Application Control Bypass - syssetup
 id: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183
 version: 1
 date: '2021-02-04'
-description: The following analytic identifies rundll32.exe loading syssetup.dll
-  by calling the LaunchINFSection function on the command line. This particular technique will load
-  script code from a file. Upon a successful execution, the following module loads
-  may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify
+description: The following analytic identifies rundll32.exe loading syssetup.dll by
+  calling the LaunchINFSection function on the command line. This particular technique
+  will load script code from a file. Upon a successful execution, the following module
+  loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify
   script content origination. Generally, a child process will spawn from rundll32.exe,
-  but that may be bypassed based on script code contents. 
-  Rundll32.exe is natively found in C:\Windows\system32 and
-  C:\Windows\syswow64. During investigation, review any
-  network connections and obtain the script content executed. It's possible other files are on disk.
+  but that may be bypassed based on script code contents. Rundll32.exe is natively
+  found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review
+  any network connections and obtain the script content executed. It's possible other
+  files are on disk.
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -24,10 +24,9 @@ references:
 author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*syssetup* by Processes.user Processes.process_name
-  Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `detect_rundll32_application_control_bypass___syssetup_filter`'
+  Processes.process=*syssetup* by Processes.user Processes.process_name Processes.process
+  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter`'
 known_false_positives: Although unlikely, some legitimate applications may use syssetup.dll,
   triggering a false positive.
 tags:
@@ -45,4 +44,5 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From 783bc38a1d174f58841d8757a0ad4aff44f91b0e Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-73-92>
Date: Fri, 5 Feb 2021 14:50:28 +0000
Subject: [PATCH 29/45] Added detection testing service results inDetect
 Rundll32 Application Control Bypass - setupapi

---
 ..._application_control_bypass___setupapi.yml | 33 +++++++++----------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
index 640ada57ad..6e28a0a422 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
@@ -2,15 +2,15 @@ name: Detect Rundll32 Application Control Bypass - setupapi
 id: 61e7b44a-6088-4f26-b788-9a96ba13b37a
 version: 1
 date: '2021-02-04'
-description: The following analytic identifies rundll32.exe loading setupapi.dll
-  and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load
-  script code from a file. Upon a successful execution, the following module loads
-  may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify
-  script content origination. Generally, a child process will spawn from rundll32.exe,
-  but that may be bypassed based on script code contents. 
-  Rundll32.exe is natively found in C:\Windows\system32 and
-  C:\Windows\syswow64. During investigation, review any
-  network connections and obtain the script content executed. It's possible other files are on disk.
+description: The following analytic identifies rundll32.exe loading setupapi.dll and
+  iesetupapi.dll by calling the LaunchINFSection function on the command line. This
+  particular technique will load script code from a file. Upon a successful execution,
+  the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During
+  investigation, identify script content origination. Generally, a child process will
+  spawn from rundll32.exe, but that may be bypassed based on script code contents.
+  Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During
+  investigation, review any network connections and obtain the script content executed.
+  It's possible other files are on disk.
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -24,13 +24,11 @@ references:
 author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*setupapi* by Processes.user Processes.process_name
-  Processes.process Processes.dest 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `detect_rundll32_application_control_bypass___setupapi_filter`'
-known_false_positives: Although unlikely, some legitimate applications may use setupapi triggering a false positive.
+  Processes.process=*setupapi* by Processes.user Processes.process_name Processes.process
+  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use setupapi
+  triggering a false positive.
 tags:
   analytics_story:
   - Suspicious Rundll32 Activity
@@ -46,4 +44,5 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From f89c21964d4200bb9334a6ff80769b82c401bf2b Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 10:54:34 -0700
Subject: [PATCH 30/45] Rundll32,StartW

Adding content to detect Rundll32 using function name Start/StartW on the commandline. Typically used with CobaltStrike.
---
 .../endpoint/suspicious_rundll32_startw.yml   | 46 +++++++++++++++++++
 .../suspicious_rundll32_startw.test.yml       | 12 +++++
 2 files changed, 58 insertions(+)
 create mode 100644 detections/endpoint/suspicious_rundll32_startw.yml
 create mode 100644 tests/endpoint/suspicious_rundll32_startw.test.yml

diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml
new file mode 100644
index 0000000000..5319706ded
--- /dev/null
+++ b/detections/endpoint/suspicious_rundll32_startw.yml
@@ -0,0 +1,46 @@
+name: Suspicious Rundll32 StartW
+id: 9319dda5-73f2-4d43-a85a-67ce961bddb7
+version: 1
+date: '2021-02-04'
+description: The following analytic identifies rundll32.exe executing a DLL
+  function name, Start and StartW, on the command line that is commonly observed with CobaltStrike x86 and x64 DLL payloads. 
+  Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+  Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). 
+  During investigation, review the parent process and other parallel application execution. Capture and triage the DLL in question. In the instance of CobaltStrike, rundll32.exe is the default process it opens and injects shellcode into. This default process can be changed, but typically is not.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://www.cobaltstrike.com/help-windows-executable
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://lolbas-project.github.io/lolbas/Libraries/Advpack/
+- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*start* by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `suspicious_rundll32_startw_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use Start as a function and call it via the command line. Filter as needed.
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
diff --git a/tests/endpoint/suspicious_rundll32_startw.test.yml b/tests/endpoint/suspicious_rundll32_startw.test.yml
new file mode 100644
index 0000000000..c0f890fc7a
--- /dev/null
+++ b/tests/endpoint/suspicious_rundll32_startw.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious Rundll32 startw Unit Test
+tests:
+- name: Suspicious Rundll32 startw
+  file: endpoint/suspicious_rundll32_startw.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From f9a6635e706f8c917b779e4d2ab6d05c13c32865 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-158-98>
Date: Tue, 9 Feb 2021 18:18:34 +0000
Subject: [PATCH 31/45] Added detection testing service results inSuspicious
 Rundll32 startw

---
 .../endpoint/suspicious_rundll32_startw.yml   | 28 +++++++++++--------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml
index 5319706ded..da2b73b2cd 100644
--- a/detections/endpoint/suspicious_rundll32_startw.yml
+++ b/detections/endpoint/suspicious_rundll32_startw.yml
@@ -2,11 +2,15 @@ name: Suspicious Rundll32 StartW
 id: 9319dda5-73f2-4d43-a85a-67ce961bddb7
 version: 1
 date: '2021-02-04'
-description: The following analytic identifies rundll32.exe executing a DLL
-  function name, Start and StartW, on the command line that is commonly observed with CobaltStrike x86 and x64 DLL payloads. 
-  Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-  Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). 
-  During investigation, review the parent process and other parallel application execution. Capture and triage the DLL in question. In the instance of CobaltStrike, rundll32.exe is the default process it opens and injects shellcode into. This default process can be changed, but typically is not.
+description: The following analytic identifies rundll32.exe executing a DLL function
+  name, Start and StartW, on the command line that is commonly observed with CobaltStrike
+  x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32
+  and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world
+  writeable path or user location. In most instances it will not have a valid certificate
+  (Unsigned). During investigation, review the parent process and other parallel application
+  execution. Capture and triage the DLL in question. In the instance of CobaltStrike,
+  rundll32.exe is the default process it opens and injects shellcode into. This default
+  process can be changed, but typically is not.
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -21,13 +25,12 @@ references:
 author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*start* by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+  Processes.process=*start* by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_rundll32_startw_filter`'
-known_false_positives: Although unlikely, some legitimate applications may use Start as a function and call it via the command line. Filter as needed.
+known_false_positives: Although unlikely, some legitimate applications may use Start
+  as a function and call it via the command line. Filter as needed.
 tags:
   analytics_story:
   - Suspicious Rundll32 Activity
@@ -43,4 +46,5 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From 3ead4c284026a1a7183de4a8463a04d3c590c4d0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 11:25:01 -0700
Subject: [PATCH 32/45] rundll32 with no cmdline arguments

---
 ...ndll32__with_no_command_line_arguments.yml | 47 +++++++++++++++++++
 ...32_with_no_command_line_arguments.test.yml | 12 +++++
 2 files changed, 59 insertions(+)
 create mode 100644 detections/endpoint/suspicious_rundll32__with_no_command_line_arguments.yml
 create mode 100644 tests/endpoint/suspicious_rundll32_with_no_command_line_arguments.test.yml

diff --git a/detections/endpoint/suspicious_rundll32__with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32__with_no_command_line_arguments.yml
new file mode 100644
index 0000000000..45211ffdb0
--- /dev/null
+++ b/detections/endpoint/suspicious_rundll32__with_no_command_line_arguments.yml
@@ -0,0 +1,47 @@
+name: Suspicious Rundll32 no CommandLine Arguments
+id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4
+version: 1
+date: '2021-02-09'
+description: The following analytic identifies rundll32.exe with no command line arguments. 
+  It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including CobaltStrike. 
+  During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. 
+  Rundll32.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://lolbas-project.github.io/lolbas/Libraries/Advpack/
+- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (process_name=rundll32.exe OR OriginalFileName=RUNDLL32.EXE)
+| regex CommandLine="(rundll32\.exe.{0,4}$)"
+| stats count min(_time) as firstTime max(_time) as lastTime by dest, User,
+  ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine
+| rename Computer as dest 
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `suspicious_rundll32_no_commandline_arguments_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of rundll32, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
diff --git a/tests/endpoint/suspicious_rundll32_with_no_command_line_arguments.test.yml b/tests/endpoint/suspicious_rundll32_with_no_command_line_arguments.test.yml
new file mode 100644
index 0000000000..917a531d96
--- /dev/null
+++ b/tests/endpoint/suspicious_rundll32_with_no_command_line_arguments.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious rundll32 with no command line arguments Unit Test
+tests:
+- name: Suspicious Rundll32 with no Command Line Arguments
+  file: endpoint/suspicious_rundll32__with_no_command_line_arguments.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From bc508128e9be092296c5b8a3045fb100030c7a3f Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 11:27:19 -0700
Subject: [PATCH 33/45] misspell

---
 ...l => suspicious_rundll32_with_no_command_line_arguments.yml} | 0
 .../suspicious_rundll32_with_no_command_line_arguments.test.yml | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename detections/endpoint/{suspicious_rundll32__with_no_command_line_arguments.yml => suspicious_rundll32_with_no_command_line_arguments.yml} (100%)

diff --git a/detections/endpoint/suspicious_rundll32__with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
similarity index 100%
rename from detections/endpoint/suspicious_rundll32__with_no_command_line_arguments.yml
rename to detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
diff --git a/tests/endpoint/suspicious_rundll32_with_no_command_line_arguments.test.yml b/tests/endpoint/suspicious_rundll32_with_no_command_line_arguments.test.yml
index 917a531d96..145ea7a51f 100644
--- a/tests/endpoint/suspicious_rundll32_with_no_command_line_arguments.test.yml
+++ b/tests/endpoint/suspicious_rundll32_with_no_command_line_arguments.test.yml
@@ -1,7 +1,7 @@
 name: Suspicious rundll32 with no command line arguments Unit Test
 tests:
 - name: Suspicious Rundll32 with no Command Line Arguments
-  file: endpoint/suspicious_rundll32__with_no_command_line_arguments.yml
+  file: endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 525e1ff46c2688ae95d6c386bf1001ceabb410a5 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-22-137>
Date: Tue, 9 Feb 2021 18:46:55 +0000
Subject: [PATCH 34/45] Added detection testing service results inSuspicious
 Rundll32 with no Command Line Arguments

---
 ...undll32_with_no_command_line_arguments.yml | 27 +++++++++----------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
index 45211ffdb0..d9e5f073b7 100644
--- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
@@ -2,15 +2,16 @@ name: Suspicious Rundll32 no CommandLine Arguments
 id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4
 version: 1
 date: '2021-02-09'
-description: The following analytic identifies rundll32.exe with no command line arguments. 
-  It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including CobaltStrike. 
-  During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. 
-  Rundll32.exe is natively found in C:\Windows\system32 and
-  C:\Windows\syswow64.
+description: The following analytic identifies rundll32.exe with no command line arguments.
+  It is unusual for rundll32.exe to execute with no command line arguments present.
+  This particular behavior is common with malicious software, including CobaltStrike.
+  During investigation, identify any network connections and parallel processes. Identify
+  any suspicious module loads related to credential dumping or file writes. Rundll32.exe
+  is natively found in C:\Windows\system32 and C:\Windows\syswow64.
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 type: ESCU
 references:
 - https://attack.mitre.org/techniques/T1218/011/
@@ -20,13 +21,10 @@ references:
 - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
 author: Michael Haag, Splunk
 search: '`sysmon` EventID=1 (process_name=rundll32.exe OR OriginalFileName=RUNDLL32.EXE)
-| regex CommandLine="(rundll32\.exe.{0,4}$)"
-| stats count min(_time) as firstTime max(_time) as lastTime by dest, User,
-  ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine
-| rename Computer as dest 
-| `security_content_ctime(firstTime)`
-| `security_content_ctime(lastTime)`
-| `suspicious_rundll32_no_commandline_arguments_filter`'
+  | regex CommandLine="(rundll32\.exe.{0,4}$)" | stats count min(_time) as firstTime
+  max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
+  OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_rundll32_no_commandline_arguments_filter`'
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
 tags:
@@ -44,4 +42,5 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From 157d8770e624c3933c528db333de4e830327ffb8 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 12:10:39 -0700
Subject: [PATCH 35/45] rundll32 dllregisterserver

---
 .../suspicious_rundll32_dllregisterserver.yml | 49 +++++++++++++++++++
 ...icious_rundll32_dllregisterserver.test.yml | 12 +++++
 2 files changed, 61 insertions(+)
 create mode 100644 detections/endpoint/suspicious_rundll32_dllregisterserver.yml
 create mode 100644 tests/endpoint/suspicious_rundll32_dllregisterserver.test.yml

diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
new file mode 100644
index 0000000000..625e045999
--- /dev/null
+++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
@@ -0,0 +1,49 @@
+name: Suspicious Rundll32 dllregisterserver
+id: 8c00a385-9b86-4ac0-8932-c9ec3713b159
+version: 1
+date: '2021-02-09'
+description: The following analytic identifies rundll32.exe using dllregisterserver
+  on the command line to load a DLL. When a DLL is registered, the DllRegisterServer
+  method entry point in the DLL is invoked. This is typically seen when a DLL is
+  being registered on the system. Not every instance is considered malicious, but it will capture malicious use of it.
+  During investigation, review the parent process and parrellel processes executing. Capture the DLL being loaded and inspect further. 
+  Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east
+- https://github.com/pan-unit42/tweets/blob/master/2020-12-10-IOCs-from-Ursnif-infection-with-Delf-variant.txt
+- https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/
+- https://msdn.microsoft.com/en-us/library/windows/desktop/ms682162(v=vs.85).aspx
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `suspicious_rundll32_dllregisterserver_filter`'
+known_false_positives: This is likely to produce false positives and will require some filtering.
+  Tune the query by adding command line paths to known good DLLs, or filtering based on parent process names.
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
diff --git a/tests/endpoint/suspicious_rundll32_dllregisterserver.test.yml b/tests/endpoint/suspicious_rundll32_dllregisterserver.test.yml
new file mode 100644
index 0000000000..f964cf33c7
--- /dev/null
+++ b/tests/endpoint/suspicious_rundll32_dllregisterserver.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious Rundll32 dllregisterserver Unit Test
+tests:
+- name: Suspicious Rundll32 dllregisterserver
+  file: endpoint/suspicious_rundll32_dllregisterserver.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From d53f30cff76dce96825ecae392fc03d93fc00464 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-66-117>
Date: Tue, 9 Feb 2021 19:37:50 +0000
Subject: [PATCH 36/45] Added detection testing service results inSuspicious
 Rundll32 dllregisterserver

---
 .../suspicious_rundll32_dllregisterserver.yml | 23 ++++++++++---------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
index 625e045999..0067f2f862 100644
--- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
+++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
@@ -4,9 +4,10 @@ version: 1
 date: '2021-02-09'
 description: The following analytic identifies rundll32.exe using dllregisterserver
   on the command line to load a DLL. When a DLL is registered, the DllRegisterServer
-  method entry point in the DLL is invoked. This is typically seen when a DLL is
-  being registered on the system. Not every instance is considered malicious, but it will capture malicious use of it.
-  During investigation, review the parent process and parrellel processes executing. Capture the DLL being loaded and inspect further. 
+  method entry point in the DLL is invoked. This is typically seen when a DLL is being
+  registered on the system. Not every instance is considered malicious, but it will
+  capture malicious use of it. During investigation, review the parent process and
+  parrellel processes executing. Capture the DLL being loaded and inspect further.
   Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -23,14 +24,13 @@ references:
 author: Michael Haag, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+  Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_rundll32_dllregisterserver_filter`'
-known_false_positives: This is likely to produce false positives and will require some filtering.
-  Tune the query by adding command line paths to known good DLLs, or filtering based on parent process names.
+known_false_positives: This is likely to produce false positives and will require
+  some filtering. Tune the query by adding command line paths to known good DLLs,
+  or filtering based on parent process names.
 tags:
   analytics_story:
   - Suspicious Rundll32 Activity
@@ -46,4 +46,5 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

From 9c08582cfaf95904059c3271b8586757d754386b Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 13:13:05 -0700
Subject: [PATCH 37/45] Update suspicious_regsvr32_rename.yml

---
 detections/endpoint/suspicious_regsvr32_rename.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_regsvr32_rename.yml b/detections/endpoint/suspicious_regsvr32_rename.yml
index 5063f10400..7676baa121 100644
--- a/detections/endpoint/suspicious_regsvr32_rename.yml
+++ b/detections/endpoint/suspicious_regsvr32_rename.yml
@@ -17,7 +17,7 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
 - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
 author: Michael Haag, Splunk
-search: '`sysmon` EventID=1 (OriginalFileName=REGSVR32.EXE OR process_name=regsvr32.exe)
+search: '`sysmon` EventID=1 OriginalFileName=REGSVR32.EXE NOT process_name=regsvr32.exe
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
   parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
   rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|

From c26c9a99890fe10ebf2d155637d938e1d306904e Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 13:57:50 -0700
Subject: [PATCH 38/45] Update dump_lsass_via_comsvcs_dll.yml

---
 detections/endpoint/dump_lsass_via_comsvcs_dll.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
index a95e490715..55763d0c30 100644
--- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
+++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
@@ -21,6 +21,7 @@ known_false_positives: None identified.
 tags:
   analytics_story:
   - Credential Dumping
+  - Suspicious Rundll32 Activity
   mitre_attack_id:
   - T1003.001
   kill_chain_phases:

From 2ce3a6adcbb17a5fdf597d54942aef2015bf4ba9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 14:01:59 -0700
Subject: [PATCH 39/45] Update suspicious_regsvr32_activity.yml

---
 stories/suspicious_regsvr32_activity.yml | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/stories/suspicious_regsvr32_activity.yml b/stories/suspicious_regsvr32_activity.yml
index cc922fe190..028bd5d873 100644
--- a/stories/suspicious_regsvr32_activity.yml
+++ b/stories/suspicious_regsvr32_activity.yml
@@ -8,9 +8,29 @@ narrative: 'One common adversary tactic is to bypass application control solutio
   via the regsvr32.exe process. This particular bypass was popularized with "SquiblyDoo"
   using the "scrobj.dll" dll to load .sct scriptlets. This technique is still widely used
   by adversaries to bypass detection and prevention controls. 
-  The file extension of the DLL is irrelevant (it may load a .txt for example). 
+  The file extension of the DLL is irrelevant (it may load a .txt file extension for example). 
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an adversary is leveraging regsvr32.exe to execute malicious code.'
+  may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. \
+  
+  Triage\
+  Validate execution \
+  1. Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further
+  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.\
+  
+  1. Determine if script code was executed with regsvr32.\
+  
+  Situational Awareness\
+  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by regsvr32.exe.\
+
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\
+
+  1. Module loads.  Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths.\
+
+  1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\
+  
+  Retrieval of Script Code\
+  The objective of this step is to confirm the executed script code is benign or malicious.'
 author: Michael Haag, Splunk
 type: ESCU
 references:

From 9db73e43c8cb18d04532d69cce014c17085a0dd7 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 14:11:38 -0700
Subject: [PATCH 40/45] Create suspicious_rundll32_activity.yml

---
 stories/suspicious_rundll32_activity.yml | 46 ++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 stories/suspicious_rundll32_activity.yml

diff --git a/stories/suspicious_rundll32_activity.yml b/stories/suspicious_rundll32_activity.yml
new file mode 100644
index 0000000000..7be74d56aa
--- /dev/null
+++ b/stories/suspicious_rundll32_activity.yml
@@ -0,0 +1,46 @@
+name: Suspicious Rundll32 Activity
+id: 80a65487-854b-42f1-80a1-935e4c170694
+version: 1
+date: '2021-02-03'
+description: Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code.
+narrative: 'One common adversary tactic is to bypass application control solutions
+  via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. 
+  The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. 
+  Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. 
+  The searches in this story help you detect and investigate suspicious activity that
+  may indicate that an adversary is leveraging rundll32.exe to execute malicious code.
+  
+  Triage\
+  Validate execution \
+  1. Determine if rundll32.exe executed. Validate the OriginalFileName of rundll32.exe and further
+  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.\
+  
+  1. Determine if script code was executed with rundll32.\
+  
+  Situational Awareness\
+  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by rundll32.exe.\
+
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\
+
+  1. Module loads.  Is rundll32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths.\
+
+  1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\
+
+  1. Command Line Arguments. If there are no command line arguments, it is possible rundll32.exe was injected into by another process.\
+  
+  1. File Modifications. Identify any suspicious file modifications.\
+
+  Retrieval of Script Code\
+  The objective of this step is to confirm the executed script code is benign or malicious.'
+author: Michael Haag, Splunk
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+tags:
+  analytics_story: Suspicious Rundll32 Activity
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics
\ No newline at end of file

From 07ffc993b420fcf9177880adcb5b2b30f56a744e Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 14:14:49 -0700
Subject: [PATCH 41/45] removing for now

---
 .../endpoint/suspicious_regsvr32_rename.yml   | 43 -------------------
 .../suspicious_regsvr32_rename.test.yml       | 12 ------
 2 files changed, 55 deletions(-)
 delete mode 100644 detections/endpoint/suspicious_regsvr32_rename.yml
 delete mode 100644 tests/endpoint/suspicious_regsvr32_rename.test.yml

diff --git a/detections/endpoint/suspicious_regsvr32_rename.yml b/detections/endpoint/suspicious_regsvr32_rename.yml
deleted file mode 100644
index 7676baa121..0000000000
--- a/detections/endpoint/suspicious_regsvr32_rename.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-name: Suspicious Regsvr32 Rename
-id: 0b8e6e18-6259-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-29'
-description: The following analytic identifies renamed instances of regsvr32.exe executing.
-  regsvr32.exe is natively found in C:\Windows\system32 and
-  C:\Windows\syswow64. During investigation, validate it is the legitimate regsvr32.exe
-  executing and what content it is loading. 
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed regsvr32.exe may be used. Review
-  paths of the renamed instance.
-type: ESCU
-references:
-- https://attack.mitre.org/techniques/T1218/010/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
-- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
-author: Michael Haag, Splunk
-search: '`sysmon` EventID=1 OriginalFileName=REGSVR32.EXE NOT process_name=regsvr32.exe
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
-  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
-  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
-  `suspicious_regsvr32_rename_filter`'
-known_false_positives: Although unlikely, some legitimate applications may use a moved
-  copy of regsvr32, triggering a false positive.
-tags:
-  analytics_story:
-  - Suspicious Regsvr32 Activity
-  mitre_attack_id:
-  - T1218.010
-  - T1036.003
-  kill_chain_phases:
-  - Actions on Objectives
-  cis20:
-  - CIS 8
-  nist:
-  - PR.PT
-  - DE.CM
-  security_domain: endpoint
-  asset_type: Endpoint
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/windows-sysmon.log
diff --git a/tests/endpoint/suspicious_regsvr32_rename.test.yml b/tests/endpoint/suspicious_regsvr32_rename.test.yml
deleted file mode 100644
index c105746de6..0000000000
--- a/tests/endpoint/suspicious_regsvr32_rename.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Suspicious regsvr32 rename
-tests:
-- name: Detect renamed regsvr32 execution
-  file: endpoint/suspicious_regsvr32_rename.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file

From c99b478d726f7e1a846c7dd8934f8edf251ee023 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 14:18:56 -0700
Subject: [PATCH 42/45] format fixing

---
 stories/suspicious_regsvr32_activity.yml | 18 +++++++++---------
 stories/suspicious_rundll32_activity.yml | 20 ++++++++++----------
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/stories/suspicious_regsvr32_activity.yml b/stories/suspicious_regsvr32_activity.yml
index 028bd5d873..b34e90ceea 100644
--- a/stories/suspicious_regsvr32_activity.yml
+++ b/stories/suspicious_regsvr32_activity.yml
@@ -12,24 +12,24 @@ narrative: 'One common adversary tactic is to bypass application control solutio
   The searches in this story help you detect and investigate suspicious activity that
   may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. \
   
-  Triage\
+  Triage \
   Validate execution \
   1. Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further
-  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.\
+  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. \
   
-  1. Determine if script code was executed with regsvr32.\
+  1. Determine if script code was executed with regsvr32. \
   
-  Situational Awareness\
+  Situational Awareness \
   The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
-  Script code by regsvr32.exe.\
+  Script code by regsvr32.exe. \
 
-  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? \
 
-  1. Module loads.  Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths.\
+  1. Module loads.  Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. \
 
-  1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\
+  1. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
   
-  Retrieval of Script Code\
+  Retrieval of Script Code \
   The objective of this step is to confirm the executed script code is benign or malicious.'
 author: Michael Haag, Splunk
 type: ESCU
diff --git a/stories/suspicious_rundll32_activity.yml b/stories/suspicious_rundll32_activity.yml
index 7be74d56aa..91af8da01f 100644
--- a/stories/suspicious_rundll32_activity.yml
+++ b/stories/suspicious_rundll32_activity.yml
@@ -10,28 +10,28 @@ narrative: 'One common adversary tactic is to bypass application control solutio
   The searches in this story help you detect and investigate suspicious activity that
   may indicate that an adversary is leveraging rundll32.exe to execute malicious code.
   
-  Triage\
+  Triage \
   Validate execution \
   1. Determine if rundll32.exe executed. Validate the OriginalFileName of rundll32.exe and further
-  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.\
+  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. \
   
-  1. Determine if script code was executed with rundll32.\
+  1. Determine if script code was executed with rundll32. \
   
   Situational Awareness\
   The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
-  Script code by rundll32.exe.\
+  Script code by rundll32.exe. \
 
-  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? \
 
-  1. Module loads.  Is rundll32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths.\
+  1. Module loads.  Is rundll32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. \
 
-  1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\
+  1. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
 
-  1. Command Line Arguments. If there are no command line arguments, it is possible rundll32.exe was injected into by another process.\
+  1. Command Line Arguments. If there are no command line arguments, it is possible rundll32.exe was injected into by another process. \
   
-  1. File Modifications. Identify any suspicious file modifications.\
+  1. File Modifications. Identify any suspicious file modifications. \
 
-  Retrieval of Script Code\
+  Retrieval of Script Code \
   The objective of this step is to confirm the executed script code is benign or malicious.'
 author: Michael Haag, Splunk
 type: ESCU

From 03a48cd47dd2215a20544b1b6a4bd330edf75ba5 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 14:24:39 -0700
Subject: [PATCH 43/45] formatting

---
 stories/suspicious_regsvr32_activity.yml | 24 ++++++++++------------
 stories/suspicious_rundll32_activity.yml | 26 +++++++++++-------------
 2 files changed, 23 insertions(+), 27 deletions(-)

diff --git a/stories/suspicious_regsvr32_activity.yml b/stories/suspicious_regsvr32_activity.yml
index b34e90ceea..c8690a8865 100644
--- a/stories/suspicious_regsvr32_activity.yml
+++ b/stories/suspicious_regsvr32_activity.yml
@@ -10,27 +10,25 @@ narrative: 'One common adversary tactic is to bypass application control solutio
   by adversaries to bypass detection and prevention controls. 
   The file extension of the DLL is irrelevant (it may load a .txt file extension for example). 
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. \
+  may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. 
   
-  Triage \
-  Validate execution \
+  Triage 
+  Validate execution 
   1. Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further
-  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. \
+  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.
   
-  1. Determine if script code was executed with regsvr32. \
+  1. Determine if script code was executed with regsvr32.
   
-  Situational Awareness \
-  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
-  Script code by regsvr32.exe. \
+  Situational Awareness - The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by regsvr32.exe. 
 
-  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? \
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
 
-  1. Module loads.  Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. \
+  1. Module loads.  Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. 
 
-  1. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
+  1. Network connections. Any network connections? Review the reputation of the remote IP or domain. 
   
-  Retrieval of Script Code \
-  The objective of this step is to confirm the executed script code is benign or malicious.'
+  Retrieval of Script Code - confirm the executed script code is benign or malicious.'
 author: Michael Haag, Splunk
 type: ESCU
 references:
diff --git a/stories/suspicious_rundll32_activity.yml b/stories/suspicious_rundll32_activity.yml
index 91af8da01f..2e9ad3a7ef 100644
--- a/stories/suspicious_rundll32_activity.yml
+++ b/stories/suspicious_rundll32_activity.yml
@@ -10,29 +10,27 @@ narrative: 'One common adversary tactic is to bypass application control solutio
   The searches in this story help you detect and investigate suspicious activity that
   may indicate that an adversary is leveraging rundll32.exe to execute malicious code.
   
-  Triage \
-  Validate execution \
+  Triage -  Validate execution
+  
   1. Determine if rundll32.exe executed. Validate the OriginalFileName of rundll32.exe and further
-  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. \
+  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. 
   
-  1. Determine if script code was executed with rundll32. \
+  1. Determine if script code was executed with rundll32. 
   
-  Situational Awareness\
-  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
-  Script code by rundll32.exe. \
+  Situational Awareness - The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by rundll32.exe. 
 
-  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? \
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
 
-  1. Module loads.  Is rundll32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. \
+  1. Module loads.  Is rundll32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. 
 
-  1. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
+  1. Network connections. Any network connections? Review the reputation of the remote IP or domain.
 
-  1. Command Line Arguments. If there are no command line arguments, it is possible rundll32.exe was injected into by another process. \
+  1. Command Line Arguments. If there are no command line arguments, it is possible rundll32.exe was injected into by another process.
   
-  1. File Modifications. Identify any suspicious file modifications. \
+  1. File Modifications. Identify any suspicious file modifications. 
 
-  Retrieval of Script Code \
-  The objective of this step is to confirm the executed script code is benign or malicious.'
+  Retrieval of Script Code - Confirm the executed script code is benign or malicious.'
 author: Michael Haag, Splunk
 type: ESCU
 references:

From c2c8d9c32061f3426ef1c51887d16d0a0d24a4f3 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 15:27:37 -0700
Subject: [PATCH 44/45] Update suspicious_regsvr32_activity.yml

---
 stories/suspicious_regsvr32_activity.yml | 21 ++++++---------------
 1 file changed, 6 insertions(+), 15 deletions(-)

diff --git a/stories/suspicious_regsvr32_activity.yml b/stories/suspicious_regsvr32_activity.yml
index c8690a8865..89aaa298eb 100644
--- a/stories/suspicious_regsvr32_activity.yml
+++ b/stories/suspicious_regsvr32_activity.yml
@@ -10,24 +10,15 @@ narrative: 'One common adversary tactic is to bypass application control solutio
   by adversaries to bypass detection and prevention controls. 
   The file extension of the DLL is irrelevant (it may load a .txt file extension for example). 
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. 
-  
-  Triage 
+  may indicate that an adversary is leveraging regsvr32.exe to execute malicious code.  
   Validate execution 
-  1. Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further
-  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.
-  
-  1. Determine if script code was executed with regsvr32.
-  
+  Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.
+  Determine if script code was executed with regsvr32.  
   Situational Awareness - The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
   Script code by regsvr32.exe. 
-
-  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
-
-  1. Module loads.  Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. 
-
-  1. Network connections. Any network connections? Review the reputation of the remote IP or domain. 
-  
+  Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
+  Module loads.  Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. 
+  Network connections. Any network connections? Review the reputation of the remote IP or domain.     
   Retrieval of Script Code - confirm the executed script code is benign or malicious.'
 author: Michael Haag, Splunk
 type: ESCU

From b6840c14f8a1021d1d05d0d67ca31e018f91d4f7 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 15:30:10 -0700
Subject: [PATCH 45/45] Update suspicious_rundll32_activity.yml

---
 stories/suspicious_rundll32_activity.yml | 24 +-----------------------
 1 file changed, 1 insertion(+), 23 deletions(-)

diff --git a/stories/suspicious_rundll32_activity.yml b/stories/suspicious_rundll32_activity.yml
index 2e9ad3a7ef..727dd2bd7d 100644
--- a/stories/suspicious_rundll32_activity.yml
+++ b/stories/suspicious_rundll32_activity.yml
@@ -8,29 +8,7 @@ narrative: 'One common adversary tactic is to bypass application control solutio
   The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. 
   Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. 
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an adversary is leveraging rundll32.exe to execute malicious code.
-  
-  Triage -  Validate execution
-  
-  1. Determine if rundll32.exe executed. Validate the OriginalFileName of rundll32.exe and further
-  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. 
-  
-  1. Determine if script code was executed with rundll32. 
-  
-  Situational Awareness - The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
-  Script code by rundll32.exe. 
-
-  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
-
-  1. Module loads.  Is rundll32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. 
-
-  1. Network connections. Any network connections? Review the reputation of the remote IP or domain.
-
-  1. Command Line Arguments. If there are no command line arguments, it is possible rundll32.exe was injected into by another process.
-  
-  1. File Modifications. Identify any suspicious file modifications. 
-
-  Retrieval of Script Code - Confirm the executed script code is benign or malicious.'
+  may indicate that an adversary is leveraging rundll32.exe to execute malicious code.'
 author: Michael Haag, Splunk
 type: ESCU
 references: